Cloudanix VulnDB

CVE-2024-58092

None

CVSS

—

EPSS

0.2%

Published

Apr 16, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A server component that shares files over a network could crash itself when started in certain configurations, interrupting access to shared files until fixed software is installed.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Double invocation of nfsd4_legacy_tracking_ops->init() triggers BUG_ON() in nfsd4_init_recdir() during NFS server legacy client tracking setup, causing a kernel crash.

Why it matters to the business

NFS servers may crash on startup or reload when legacy client tracking is enabled, leading to unplanned downtime and service disruption for file-sharing workloads.

How an attack unfolds

An attacker triggers the vulnerable initialization path by starting or reconfiguring the NFS server daemon under conditions that invoke check_for_legacy_methods(), resulting in the second init call and immediate kernel panic.

How to fix it

Update to a kernel containing commit 95407304253a4bf03494d921c6913e220c26cc63 or apply the Red Hat pam package updates to 1.3.1-36.el8_10 (or later) where backported; restart affected NFS services after upgrade.

How to confirm the fix worked

Confirm the running kernel contains commit 95407304253a4bf03494d921c6913e220c26cc63 via git log or uname; verify pam package versions match or exceed the fixed releases; test NFS server startup without triggering BUG_ON().

Typical attack path

  1. Identify a system running an unpatched kernel with NFS server enabled and legacy tracking configured
  2. Cause the nfsd daemon to execute client tracking initialization (e.g., via service start or export reload)
  3. Trigger the double-init path in check_for_legacy_methods()
  4. Hit the BUG_ON() and crash the kernel

How to detect it

Review kernel logs for BUG_ON() or oops entries referencing nfsd4_init_recdir or nfsd4_legacy_tracking_ops around NFS daemon startup times; inspect system boot and service logs for repeated initialization attempts.

What your security team should do

  • Prioritize patching kernel or pam packages on all systems exposing NFS services
  • Monitor for kernel oops or BUG_ON() messages related to nfsd4_init_recdir during NFS startup
  • Test NFS service restarts in a staging environment after applying fixes

The record

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix legacy client tracking initialization Get rid of the nfsd4_legacy_tracking_ops->init() call in check_for_legacy_methods(). That will be handled in the caller (nfsd4_client_tracking_init()). Otherwise, we'll wind up calling nfsd4_legacy_tracking_ops->init() twice, and the second time we'll trigger the BUG_ON() in nfsd4_init_recdir().

Affected packages

Ecosystem Package Introduced Fixed
Debian:13 linux 0 No fix
Linux Kernel 6.8.0 6.12.22

Related vulnerabilities